mirror of
https://github.com/kernelkit/infix.git
synced 2026-08-05 23:23:02 +02:00
Joachim Wiberg
3224f49b65
Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld The terminology is a mix of firewalld, classic netfilter and inspired by Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview. - Port forwarding allows forwarding a range of ports - Operational data comes from firewalld active rules - Firewall logging goes to /var/log/firewall.log - Show implicit/built-in rules and zones (HOST) in firewall matrix, includes "locked" policy for the default-drop behavior - The zone services field in admin-exec 'show firewall' shows ANY when the zone default action is set to 'accept' - Zone 'forwarding' and 'masquerade' settings live in Infix in the policys instead, meaning users need to explicitly add a policy to allow both intra-zone and inter-zone forwarding - Support for emergency lockdown (kill switch) - Pre-defined services (xml+enums) are filtered and included as a separate YANG model, extensions added for netconf and restconf - Includes initial support for firewalld rich rules firewalld policy rules, including rich rules, have an obnoxious priority field which is extremely hard to get right, so in Infix we use the far superior YANG construct 'ordered-by user;'. This ensure all rules are generated in that order by setting the priority field, on read-back from firewalld (operational) the priority field is used to sort the output of rules in the CLI. Fixes #448 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
41 lines
2.2 KiB
Diff
41 lines
2.2 KiB
Diff
diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py
|
|
index 0a51cfff..8afd6113 100644
|
|
--- a/src/firewall/core/fw.py
|
|
+++ b/src/firewall/core/fw.py
|
|
@@ -223,7 +223,7 @@ class Firewall(object):
|
|
self.ipset_backend.set_list()
|
|
except ValueError:
|
|
if self.nftables_enabled:
|
|
- log.info1("ipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.")
|
|
+ log.debug1("ipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.")
|
|
else:
|
|
log.warning("ipset not usable, disabling ipset usage in firewall.")
|
|
self.ipset_supported_types = [ ]
|
|
@@ -240,7 +240,7 @@ class Firewall(object):
|
|
"individual calls for IPv4 firewall.")
|
|
else:
|
|
if self.nftables_enabled:
|
|
- log.info1("iptables-restore and iptables are missing, "
|
|
+ log.debug1("iptables-restore and iptables are missing, "
|
|
"IPv4 direct rules won't be usable.")
|
|
else:
|
|
log.warning("iptables-restore and iptables are missing, "
|
|
@@ -260,7 +260,7 @@ class Firewall(object):
|
|
"individual calls for IPv6 firewall.")
|
|
else:
|
|
if self.nftables_enabled:
|
|
- log.info1("ip6tables-restore and ip6tables are missing, "
|
|
+ log.debug1("ip6tables-restore and ip6tables are missing, "
|
|
"IPv6 direct rules won't be usable.")
|
|
else:
|
|
log.warning("ip6tables-restore and ip6tables are missing, "
|
|
@@ -280,7 +280,7 @@ class Firewall(object):
|
|
"individual calls for bridge firewall.")
|
|
else:
|
|
if self.nftables_enabled:
|
|
- log.info1("ebtables-restore and ebtables are missing, "
|
|
+ log.debug1("ebtables-restore and ebtables are missing, "
|
|
"eb direct rules won't be usable.")
|
|
else:
|
|
log.warning("ebtables-restore and ebtables are missing, "
|